A California teenager prosecutors say is accountable for lots of of swatting assaults round the US was uncovered after legislation enforcement pieced collectively a digital path left on a number of the web’s largest platforms, based on court docket data launched this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces 4 felony fees in Florida’s Seminole County associated to swatting, or faux threats known as into the police to impress a forceful response, based on Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the fruits of a multi-agency manhunt for the particular person police declare is accountable for swatting assaults on excessive faculties, traditionally black faculties and universities, mosques, and federal brokers, and for threats to bomb the Pentagon, members of the US Senate, and the US Supreme Courtroom. In the end, a YouTube channel, Discord chats, and usernames associated to The Lord of the Rings helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with 4 felony counts, together with three associated to allegedly making false experiences to legislation enforcement and one for illegal use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say focused folks based mostly on race, faith, or different protected lessons. Whereas prosecutors alleged that Filion “is accountable for lots of of swatting and bomb menace incidents all through the US,” the costs Filion faces relate to a single Might 12, 2023, swatting assault towards the Masjid Al Hayy Mosque in Sanford, Florida.

An legal professional for Filion was not instantly out there to reply to WIRED’s request for remark.

Greater than a 12 months earlier than the swatting assault on the Florida mosque, brokers with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his dwelling in Lancaster, California, based on court docket paperwork made public on Wednesday. The interview befell on April 21, 2022, the identical day the proprietor of a Telegram channel linked to swatting exercise posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a college in Anacortes, Washington, got here throughout a Telegram person related to a number of swatting and doxing channels. The person, “Nazgul Swattings,” had claimed duty in considered one of these channels for the threats to the Washington faculties, based on the identical court docket paperwork.

Over the next months, court docket data say, the FBI monitored channels linked to this person. A kind of, a channel known as Torswats (previously Nazgul Swats), had shared recordings of almost 20 hoax calls threatening areas across the nation, together with faculties in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

Because the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a personal investigator, was operating his personal parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a person behind Torswats and requested to talk on a peer-to-peer chatting service known as Tox beneath the guise of ordering a swat. In response to data shared with WIRED, not talked about within the arrest warrant, whereas interacting on Tox, Dennis used Wireshark to watch his community visitors. Within the course of, he uncovered an IP handle and the username “Paimon Arnum,” which was beforehand unknown to legislation enforcement.